Been running debian with virtualized opnsense on a Lenovo tiny m920q for 5+ years, no issues yet. There are a bunch of the older lenovo tiny PCs that have a pci-e slot, some from memory:
- M720q tiny
- M920q tiny
- P330 tiny
- P340 tiny
You could also go the thin client route, the dell wyze 5070 extended has a pci-e slot and very low idle power consumption, but if you want to do demanding stuff (IDS/IPS) the CPU might be a bottleneck.